0

From the security perspective (and not usability as it's discussed here https://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), why is it a bad idea to escape HTML before escaping SQL?

Improve this question
4
  • 4
    I think you may have misread the question and answers. I don't see anything about escaping SQL or SQL injection in there.
    – Xander
    May 23, 2014 at 15:19
  • Have a look at my answer to Preventing code injection without limiting user input?
    – Gumbo
    May 24, 2014 at 5:46
  • @Gumbo now thinking... what about the semicolon? Escaping HTML will introduce a semicolon (e.g. $quot;), and could not be this used to exploit the DB?
    – user15194
    May 25, 2014 at 9:57
  • @yzT It would only appear within string literals, where it wouldn’t be interpreted as statement separator.
    – Gumbo
    May 25, 2014 at 10:02

1 Answer 1

Reset to default
0

With regard to database security, it's irrelevant. SQL doesn't care if the string contains raw HTML or escaped HTML or whatever.

But as explained in the other question, this messes up the data. I would actually consider it a bug.

Improve this answer